CVE-2026-126559
Received Received - Intake

Stored XSS in Semantic MediaWiki Profiles

Publication date: 2026-11-11

Last updated on: 2026-11-11

Assigner: VulnCheck

Description
Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles() that allows users with the smw-schemaedit right to inject markup. Attackers can save FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels that break out of option elements, executing scripts for every Special:FacetedSearch visitor including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-11
Last Modified
2026-11-11
Generated
2026-11-11
AI Q&A
2026-11-11
EPSS Evaluated
N/A
NVD
CVE-2026-126559
EUVD
EUVD-2026-123074

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
semantic_mediawiki semantic_mediawiki to 7.4.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Semantic MediaWiki versions 4.2.0 through 7.4.0. Users with the smw-schemaedit permission can inject malicious markup into profile keys or labels in the Special:FacetedSearch feature. The injected scripts execute for every visitor, including administrators, due to improper escaping of HTML option elements.

Detection Guidance

Check Semantic MediaWiki version with: php maintenance/eval.php 'echo SMW_VERSION;'. If version is between 4.2.0 and 7.4.0, the system is vulnerable. Inspect Special:FacetedSearch page for unexpected scripts in profile options. Review user permissions for smw-schemaedit rights.

Impact Analysis

Attackers can execute arbitrary scripts on visitors of Special:FacetedSearch, including administrators. This may lead to session hijacking, data theft, or privilege escalation. The impact includes potential loss of confidentiality and integrity of user data.

Compliance Impact

This vulnerability could violate GDPR and HIPAA by enabling unauthorized access to sensitive user data. Stored XSS may lead to data breaches, compromising protected health information or personal data, resulting in legal and regulatory penalties.

Mitigation Strategies

Upgrade Semantic MediaWiki to version 7.4.1 or later immediately. Remove smw-schemaedit permissions from non-trusted users until patched. Review and sanitize existing profile schemas for malicious markup.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126559. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...